1. Field
Exemplary embodiments relate to a technique for detecting external attacks relating to Address Resolution Protocol (ARP) spoofing by using the vulnerabilities of ARP.
2. Discussion of Related Art
Recently, incidents in which overseas attackers hack domestic websites and insert malicious codes into the domestic websites have been frequently occurring. In the case of such hacking, generally, web servers are hacked, and then malicious codes are inserted by using the hacked web servers. However, recently, cases in which malicious codes and other destructive forms of information are downloaded from a web server which has not been hacked have been occurring. The cases are generated when a sniffer hacks another server which resides in the same Internet Protocol (IP) segment to which a target web server belongs, intercepts web traffic related to the target web server by using Address Resolution Protocol (ARP) spoofing, and inserts malicious codes into the web traffic.
ARP spoofing attacks are used by sniffers to disguise their Media Access Control (MAC) address as a MAC address of another computer that is used in a local area network (LAN) by exploiting the vulnerabilities of ARP. ARP spoofing attacks are also referred to as ARP cache poisoning attacks, because they arbitrarily change ARP cache information.
By using ARP spoofing attacks, a sniffer can disguise a MAC address as a MAC address of a router or as a MAC address of a target server in order to easily intercept packets. However, recently, ARP spoofing attacks have become more problematic, because they have evolved into attacks which involve intercepting packets, modifying the packets, and then re-transmitting the modified packets. Accordingly, technology for easily detecting ARP spoofing attacks by using a switch, or by using other types of equipment which are commonly used, and blocking the ARP spoofing attacks is needed.